Use apt preferences instead of dpkg holds

Author: atj

defaults/main.yml

@@ -5,7 +5,7 @@ consul_repository_key_path: /usr/share/keyrings/consul.asc
 #consul_repository_key_checksum:
 
 #consul_package_version:
-#consul_package_dpkg_selection: hold
+consul_package_pin_priority: 990
 consul_package_state: present
 consul_package_policy_rc_d: 101
 

molecule/default/inventory/group_vars/consul_servers.yml

@@ -1,4 +1,5 @@
 ---
+consul_package_version: "1.16.5*"
 consul_server: true
 
 consul_server_group_configuration:

molecule/default/inventory/host_vars/client1.yml

@@ -1,6 +1,5 @@
 ---
-consul_package_version: 1.15.1-1
-consul_package_dpkg_selection: hold
+consul_package_version: "1.15.1-1"
 
 consul_client_host_configuration:
   retry_join: >-

molecule/default/verify.yml

@@ -16,6 +16,14 @@
   hosts: consul_servers
   gather_facts: false
   tasks:
+    - name: Ensure expected Consul version is installed
+      ansible.builtin.command: dpkg-query -f '${Version}' -W consul
+      register: result
+      changed_when: false
+      failed_when: >-
+        result.rc != 0 or
+        result.stdout is not match("1\.16\.5")
+
     - name: Ensure Consul is running
       ansible.builtin.service:
         name: consul-server
@@ -49,19 +57,13 @@
   hosts: client1
   gather_facts: false
   tasks:
-    - name: Check dpkg selection state
-      ansible.builtin.dpkg_selections:
-        name: consul
-        selection: "{{ consul_package_dpkg_selection }}"
-      check_mode: true
-      register: result
-      failed_when: result is changed
-
-    - name: Check installed package version
+    - name: Ensure expected Consul version is installed
       ansible.builtin.command: dpkg-query -f '${Version}' -W consul
       register: result
-      failed_when: result.stdout != consul_package_version
       changed_when: false
+      failed_when: >-
+        result.rc != 0 or
+        result.stdout != "1.15.1-1"
 
     - name: Add a key/value entry to Consul
       community.general.consul_kv:

tasks/main.yml

@@ -1,23 +1,19 @@
 - name: Install package repository
   ansible.builtin.include_tasks: repository.yml
 
+- name: Install Consul apt preferences
+  ansible.builtin.template:
+    src: etc/apt/preferences.d/99-ansible-consul.j2
+    dest: /etc/apt/preferences.d/99-ansible-consul
+    mode: "0644"
+
 - name: Install Consul package
   ansible.builtin.apt:
-    name: >-
-      {{
-        'consul={}'.format(consul_package_version) if (consul_package_version | d())
-        else 'consul'
-      }}
+    name: "{{ consul_package }}"
     state: "{{ consul_package_state }}"
     policy_rc_d: "{{ consul_package_policy_rc_d }}"
   ignore_errors: "{{ ansible_check_mode }}"
 
-- name: Set Consul package dpkg selection state
-  ansible.builtin.dpkg_selections:
-    name: consul
-    selection: "{{ consul_package_dpkg_selection }}"
-  when: consul_package_dpkg_selection | d()
-
 - name: Mask Consul service installed by package
   ansible.builtin.systemd:
     name: consul

templates/etc/apt/preferences.d/99-ansible-consul.j2

@@ -0,0 +1,8 @@
+#jinja2: trim_blocks: True, lstrip_blocks: True
+# {{ ansible_managed }}
+{% if consul_package_version|d() %}
+
+Package: {{ consul_package }}
+Pin: version {{ consul_package_version }}
+Pin-Priority: {{ consul_package_pin_priority }}
+{% endif %}

vars/main.yml

@@ -1,4 +1,5 @@
 ---
+consul_package: consul
 consul_binary_path: /usr/bin/consul
 consul_client_service_name: consul-client
 consul_server_service_name: consul-server